MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac
SHA3-384 hash:	0dcabfa242934d46fa2aa39ade99ad2f92ed6c471fb27bf6822be1ef1a24f9bdd4f024db8bb3c1fe0cbf8c106c7791d6
SHA1 hash:	55e33706f57108668e2de1d108085d4b897c2a08
MD5 hash:	9fdb24226fb9c26e2032d51e503d9314
humanhash:	florida-beer-three-connecticut
File name:	f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac.bin
Download:	download sample
Signature	Vidar Alert Create hunting rule
File size:	103'633'784 bytes
First seen:	2026-09-14 11:51:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ebc247a77b4d4a804b261f97a1fd075c (116 x Vidar, 32 x RemusStealer, 26 x Smoke Loader)
ssdeep	1572864:LyTTYUrsvoSQhqzRVTLcK3Ui/MP1w2g99fWz3MNgovslaUvnHOqkxwtI2H2o50:Wv5svvQcD3fke99fOovAaUvuqkxPs50
TLSH	T10E383303FAA564D4C49AFA78C8B79666B7307C89C73233E70E446A342F263D09D79794
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Anonymous
Tags:	exe vidar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

236

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

DNS request

Launching a service

Behavior that indicates a threat

Sending a custom TCP request

Sending an HTTP GET request

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

crypto golang masquerade overlay packed

Link:

https://www.filescan.io/uploads/6aa7dff45997ad24b161b5cd/reports/29d62ded-4296-443e-bb41-e368fb6c39f3/overview

Hybrid Analysis Win64/GenKryptik.HUFD trojan

Verdict:

Malicious

Labled as:

Win64/GenKryptik.HUFD trojan

Link:

https://www.hybrid-analysis.com/sample/f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-13T15:55:00Z UTC

Last seen:

2026-09-14T10:53:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac/results?tab=lookup

Nucleon Malprob Susipicious

Score:

67%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/f65d4ddf2d769eb6dd9cc7021845458f7cb49be01f1859328f62407924a7d7ac

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Ravartar

Threat name:

Win64.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-13 21:19:21 UTC

File Type:

PE+ (Exe)

AV detection:

20 of 38 (52.63%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6zou3xzno2plnxm4y4bbqrkfr56ljg7ad4mfsmupmjahsjfh26wa._file

Threatray Vidar

Verdict:

malicious

Label(s):

Vidar

Alert

Create hunting rule

Link:

https://reports.threatray.com/51c03494-b46e-419a-8950-5d2e13ebdd28

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/260914-n1wsvsxxbz/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Checks for VirtualBox DLLs, possible anti-VM trick

Checks system information in the registry

Checks BIOS information in registry

Looks for VMWare Tools registry key

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

VMRay Vidar

Malware family:

Vidar

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f65d4ddf2d76/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malpedia

https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar